Description
Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
Remediation
References
https://akka.io/security/alpakka-kafka-cve-2023-29471.html
https://github.com/akka/alpakka-kafka/issues/1592
Related Vulnerabilities
CVE-2018-8010 Vulnerability in maven package org.apache.solr:solr-core
CVE-2020-11971 Vulnerability in maven package org.apache.camel:camel-core
CVE-2023-24447 Vulnerability in maven package org.jenkins-ci.plugins:rabbitmq-consumer
CVE-2019-8331 Vulnerability in maven package org.webjars.bowergithub.angular-ui:bootstrap
CVE-2023-49448 Vulnerability in maven package com.jfinal:jfinal